Quick answer

Generally, no. A lending app, lending company, financing company, or its collection agency cannot contact a borrower’s relatives, employer, former partner, friends, or other phone contacts to demand payment, disclose the debt, shame the borrower, or pressure those people into paying.

For debt collection, the lender may contact the borrower and a person who validly agreed to be a guarantor or co-maker. Merely appearing in the borrower’s phone, being related to the borrower, working with the borrower, or having once been the borrower’s partner does not make someone liable for the loan.

A genuine character reference may be contacted only to verify the borrower’s identity and the truthfulness of information supplied during the loan application. A character reference is not automatically a guarantor and must be allowed to request removal of their personal data as a reference.

These restrictions apply even if the borrower previously allowed the app to access a contact list. Consent does not authorize indiscriminate collection calls, text blasts, public shaming, harassment, or disclosure of loan information to unrelated third parties.

The controlling rules

Two overlapping sets of rules ordinarily apply:

The Securities and Exchange Commission’s rules prohibit unfair debt-collection practices by lending companies, financing companies, and third-party collection providers acting for them.
The Data Privacy Act and National Privacy Commission rules govern how lenders collect, access, use, disclose, retain, and otherwise process personal data.

Under SEC Memorandum Circular No. 18, Series of 2019, contacting people in the borrower’s contact list other than named guarantors or co-makers is an unfair collection practice, notwithstanding the borrower’s consent.

The NPC’s amended loan-transaction rules likewise state that, for debt collection, lenders may contact only the guarantor. Contacting other people in the borrower’s contact list is prohibited. The rules appear in NPC Circular No. 2022-02, which amended NPC Circular No. 2020-01.

The broader Data Privacy Act of 2012 also requires personal-data processing to be transparent, lawful, fair, for a legitimate declared purpose, and proportionate. Data must be adequate and relevant—not excessive for the stated purpose.

When may a lender contact another person?

The answer depends on that person’s documented role.

A guarantor or co-maker

A lender may contact a valid guarantor or co-maker concerning the obligation. But the label used by the app is not conclusive.

Under NPC Circular No. 2022-02, a guarantor is someone who expressly binds themselves to fulfill the borrower’s obligation if the borrower fails to do so. The lender must obtain the guarantor’s separate consent consistent with the Data Privacy Act. The validity and extent of the obligation may depend on the signed or electronically executed documents and the Civil Code rules on guaranty.

A lender cannot turn a relative, employer, former partner, or phone contact into a guarantor simply by:

calling that person a “reference”;
obtaining the number from the borrower’s phone;
placing the person’s name in an app form without their agreement;
claiming that the borrower gave consent on their behalf; or
telling the person that family or personal relationships make them responsible.

Anyone being pursued as a guarantor should ask for the specific document bearing their consent and showing the terms of the alleged guaranty or co-maker obligation.

A character reference

A character reference may be contacted to verify the borrower’s identity and the truthfulness of information provided for the loan application. The borrower is responsible for informing the person that they were named as a reference.

The lender must also tell the reference:

that the borrower selected them as a character reference;
how the lender obtained their contact details; and
that they may request removal of their personal data as a character reference.

A character reference cannot automatically be treated as a guarantor. The lender also cannot use the reference’s details for debt collection, marketing, cross-selling, or sharing with third parties for offers of other products or services.

A person who is neither a guarantor nor a reference

A lender generally has no basis to contact that person about collection merely because the number appears in the borrower’s phone, email contacts, social-media contacts, workplace records, or past communications.

Accessing a contact list for limited, proportionate purposes does not authorize the lender to call everyone in it. NPC rules expressly prohibit unconstrained, excessive, or disproportionate processing, including processing that:

leads to harassment;
collects a debt from people other than the borrower’s guarantors; or
results in an unfair collection practice.

Relatives are not automatically responsible for the debt

Parents, children, siblings, cousins, and other relatives do not become liable merely because of their family relationship with the borrower.

A relative may be contacted about collection only if there is an independent and legally relevant basis—most commonly, because that person validly agreed to be a guarantor or co-maker. If the obligation involves spouses, conjugal or community property, an estate, succession, or a business arrangement, liability can depend on additional facts and documents. Family status alone is not enough to settle those questions.

A collector should not:

tell relatives to pay solely because they are family;
reveal the loan to relatives to embarrass the borrower;
repeatedly call family members who are not guarantors or co-makers;
threaten relatives’ property, reputation, employment, or safety; or
publish the borrower’s name, photograph, loan balance, or alleged default in a family or community group.

An employer or co-worker ordinarily should not receive the borrower’s loan information

A lender may try to reach the borrower through a work number that the borrower personally supplied. Even then, collection must remain directed to the borrower and handled without unnecessary disclosure.

The lender should not tell a supervisor, human-resources officer, receptionist, co-worker, client, or business contact about the loan merely to create pressure or embarrassment. An employer does not become liable for an employee’s personal loan unless the employer separately entered into a legally enforceable undertaking.

If a collector calls the workplace, a neutral request to speak privately with the borrower is materially different from telling other employees that the borrower is delinquent, demanding that management force payment, sending loan details to a company-wide address, or threatening the borrower’s employment.

A court order, lawful garnishment process, or another specific legal requirement may create a different situation. A collector’s unsupported claim that it will “coordinate with HR” is not itself such legal authority.

A former partner has no special collection responsibility

A former boyfriend, girlfriend, live-in partner, fiancé, or spouse is not automatically answerable for the borrower’s loan.

The lender may contact that person for collection only if the person validly became a guarantor, co-maker, co-borrower, or other legally responsible party. A former partner listed only as a contact or character reference cannot be pursued for payment on that basis alone.

Questions involving a present or former spouse can require closer examination of when and why the debt was incurred, the applicable property regime, and the loan documents. A collector’s assertion of spousal responsibility should not be accepted without reviewing those matters.

What collection conduct is prohibited?

SEC rules allow reasonable and legally permissible collection methods, exercised in good faith and with reasonable conduct. They prohibit practices including:

using or threatening violence or other criminal means against any person, reputation, or property;
threatening action that cannot legally be taken;
using obscenities, insults, or profane or abusive language;
disclosing or publishing the names or personal information of borrowers who allegedly refuse to pay, except where legally allowed;
giving or threatening to give another person loan information known, or reasonably expected, to be false;
failing to say that a debt is disputed when communicating information covered by the rule;
using false representations or deceptive means to collect or obtain information about the borrower;
contacting people in the borrower’s contact list who are not named guarantors or co-makers; and
contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions when an account is over 15 days past due or the borrower has given recorded, written, or electronic consent because those are the only reasonable or convenient hours.

The time exception does not authorize threats, shaming, third-party disclosure, or calls to unrelated contacts.

The SEC has applied these rules against online lending operators that used borrowers’ contact information for text blasts and disclosed alleged nonpayment. Its official cease-and-desist order concerning CashAB and other operators illustrates how contact-list collection and public-pressure tactics can support enforcement action.

“The borrower consented” is not a complete defense

A privacy notice or permission screen does not give a lender unlimited authority over every contact stored on a phone.

Under NPC Circular No. 2022-02:

lenders must obtain consent when the relevant personal data becomes necessary;
they should provide a just-in-time notice explaining how that information will be processed;
app permissions must be suitable, necessary, and not excessive for a legitimate purpose;
unnecessary access to personal or sensitive personal information is prohibited;
unconstrained or disproportionate contact-list processing is prohibited; and
contacting non-guarantor contacts for collection remains prohibited.

The lender must also consider the rights of the third person whose number was taken. The borrower ordinarily cannot supply legally sufficient consent on behalf of an unsuspecting relative, employer, former partner, or friend.

What to do if a lender contacts other people

1. Preserve the evidence before blocking anything

Save the material in its original form where possible:

screenshots showing the complete message, sender, date, and time;
call logs and the numbers used;
voicemail or lawfully obtained recordings;
emails, including sender details and attachments;
social-media posts, group messages, profile names, and links;
messages received by relatives, employers, or former partners;
the app’s name, developer, download page, and displayed company name;
the privacy notice, permissions screen, loan agreement, disclosure statement, and collection policy;
payment records and communications disputing the amount;
the collector’s name, agency, account reference, and claimed authority; and
proof of harm, such as an HR notice or a written statement from a contacted person.

Ask each third-party recipient to preserve their own copy and briefly record what was said. Avoid editing screenshots in a way that removes context. Keep backups outside the affected phone.

2. Revoke unnecessary app permissions

In the phone’s settings, review and disable access that is no longer necessary, particularly contacts, call logs, messages, camera, photographs, location, microphone, and social-media data.

Do not delete the app until important evidence, account information, and transaction documents have been preserved. Removing permissions or uninstalling an app does not cancel a valid debt.

3. Send a written demand to the lender and its data-protection contact

Identify the incident precisely and request that the company:

stop contacting non-guarantors and non-co-makers;
stop disclosing the loan to third parties;
identify the company and collector responsible;
disclose how the third person’s details were obtained and used;
preserve relevant call, access, and processing records;
correct false account information;
remove a person’s data as a character reference when requested; and
confirm the corrective action in writing.

The borrower and an affected third person may each have separate data-subject rights. Under the Data Privacy Act and its Implementing Rules and Regulations, those rights may include being informed, obtaining access, disputing inaccuracies, and seeking erasure or blocking when the legal conditions are met. Erasure is not absolute where retention remains authorized or necessary for a legal claim or another lawful purpose.

Keep proof that the written notice was sent and received.

4. Complain to the proper regulator

For unfair collection by a lending or financing company, use the SEC’s official lending and financing company complaint guidance. The SEC instructs complainants to complete its form, attach evidence and a valid government-issued ID, and submit one complaint form for each respondent company. Its current online inquiry and complaint portal is SEC iMessage.

For unauthorized contact access, disclosure, or other misuse of personal data, a complaint may be filed with the National Privacy Commission. As a general procedural requirement, the complainant must first notify the respondent in writing and allow it to act. If there is no timely or appropriate action, or no response within 15 calendar days after receipt, proof of that step should accompany the complaint. The NPC explains this requirement in its complaint mechanics.

The NPC’s formal complaint page provides the current complaint form and submission instructions. It states that the complaint must be completed, notarized, and submitted in person, by courier, or by scanned email, together with supporting documents.

If the lender is a bank or another institution supervised by the Bangko Sentral ng Pilipinas rather than an SEC-regulated lending or financing company, the correct financial regulator may differ. Check the entity named in the contract, not just the app’s brand.

5. Continue addressing the loan separately

An improper collection method does not automatically erase the principal, interest, or other valid obligations under the loan. Ask for an itemized statement and dispute inaccuracies in writing. Pay only through verified company channels, obtain a receipt, and do not send money to an unidentified collector’s personal account without confirming authority.

The SEC complaint process cannot itself rewrite the contract, cancel the debt, declare the agreement void, or settle the account for the parties.

Common mistakes to avoid

Do not assume every aggressive message came from the company named in the app. Verify the corporate name and the collector’s authority.
Do not pay a relative, “field officer,” or personal e-wallet account merely to stop threats.
Do not concede that someone is a guarantor without seeing the document showing their own agreement.
Do not rely only on cropped screenshots that hide the sender, date, or context.
Do not retaliate by publishing collectors’ personal data or making threats.
Do not ignore legitimate court papers because earlier collection messages were abusive.
Do not assume deleting the app deletes data already copied to the lender’s systems.
Do not stop all communication without first giving the lender a safe written channel for account notices and dispute resolution.
Do not treat a privacy or SEC complaint as an automatic suspension or cancellation of payment obligations.

When help is urgent

Seek prompt legal or law-enforcement assistance if the conduct includes:

a credible threat of violence or physical harm;
extortion, blackmail, stalking, or coercion;
publication of intimate material or a threat to publish it;
identity theft or unauthorized transactions;
impersonation of a court, police officer, prosecutor, or government agency;
entry into a home or workplace without permission;
threats against children or other vulnerable people;
imminent job loss or serious reputational harm caused by disclosure; or
an actual summons, subpoena, court order, or other official process with a response deadline.

Call local emergency services if anyone faces immediate danger. For criminal conduct, preserve the evidence and consider reporting to the Philippine National Police or the National Bureau of Investigation. A lawyer can help determine whether the facts also support civil, criminal, employment, or protective remedies.

Frequently asked questions

Can the app call my parents because I missed a payment?

Not merely because they are your parents. The lender may pursue you through lawful collection methods. It may contact a parent about collection only if that parent validly became a guarantor, co-maker, or other liable party.

Can the lender ask my employer to deduct the debt from my salary?

Not simply by calling HR. A lawful salary deduction, garnishment, or similar measure requires an applicable legal or contractual basis and the proper process. An unsupported demand from a collector does not by itself authorize the employer to disclose information or deduct wages.

Can the lender call my office just to reach me?

A private attempt to reach the borrower through a work number the borrower supplied is different from contacting the employer about the debt. The collector should avoid revealing loan information to receptionists, co-workers, supervisors, or HR and should use a direct, confidential channel once available.

What if my relative was listed as an “emergency contact”?

That label does not make the relative a guarantor or co-maker. It also does not authorize collection calls to that person. The person’s actual role, consent, and supporting documents matter.

What if I named someone as a character reference?

The lender may contact that person for identity and information verification during the loan evaluation. It must not automatically treat the reference as a guarantor or use the reference for debt collection. The reference must be informed how the details were obtained and given an option to request removal as a reference.

Can the lender contact my former spouse?

Only if there is a separate lawful basis, such as a valid co-borrower, guarantor, or co-maker obligation. Questions about possible spousal or property liability depend on the documents, timing, purpose of the debt, and applicable property regime.

Does allowing contacts access make the calls legal?

No. Even borrower consent does not make it permissible to contact non-guarantors in the phonebook for collection. App access must still be necessary, proportionate, transparent, and used only for a lawful declared purpose.

May the lender post my photograph or debt on social media?

Using a borrower’s photograph or personal information to harass, embarrass, or publicly shame the borrower is prohibited. Preserve the post, link, account information, date, and audience before requesting removal and reporting it.

If the collection was illegal, do I still owe the loan?

Possibly. Collection violations and the validity or amount of the debt are separate issues. An abusive or privacy-infringing collection act does not automatically cancel an otherwise valid obligation, although the borrower may dispute unauthorized charges or other contract issues through the proper process.

Can the lender use an outside collection agency?

Yes, but outsourcing does not remove the lender’s responsibilities. The lender remains accountable for personal data under its control, and a third-party collector must follow the applicable collection and privacy rules.

Official sources

This article provides general Philippine legal information, not legal advice for a particular loan, marriage, employment situation, complaint, or court case. Liability and remedies can depend on the contract, consent records, corporate identity of the lender, communications, and other evidence. Official sources and procedures were checked as of August 27, 2026. D